Missing Authorization

Overview @frangoteam/fuxa is a Web-based Process Visualization SCADA/HMI/Dashboard software Affected versions of this package are vulnerable to Missing Authorization in the scheduler endpoint. An attacker can gain unauthorized access to create, modify, or delete schedules by sending crafted...

CVE-2026-25895

creationtimestamp| type| source ---|---|--- 2026-02-10 00:00:48+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mehntchb352m 2026-02-10 00:00:50+00:00| seen| https://infosec.exchange/users/offseq/statuses/116043392265377056 2026-04-24 22:00:05+00:00| published-proof-of-concept|...

GHSA-2453-MPPF-46CJ

creationtimestamp| type| source ---|---|--- 2026-02-09 23:40:05+00:00| seen| https://gist.github.com/alon710/05c03b478ac40a36955b23403707c5ec 2026-04-13 23:21:07+00:00| seen| Telegram/sslKRMt7XnAICw7zsZDqotnt2tiVrXD0JXK6a6QUxCGOW4...

GHSA-9F5H-MMQ6-2X78

creationtimestamp| type| source ---|---|--- 2026-02-09 23:10:05+00:00| seen| https://gist.github.com/alon710/f17e6e93e24b62efe6529ae7f171eec3...

GHSA-FXP3-G6GW-4R4V

creationtimestamp| type| source ---|---|--- 2026-02-09 22:40:05+00:00| seen| https://gist.github.com/alon710/0e2af79b6e2e09f5b68854774d91ca42...

CVE-2026-25939 FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on...

CVE-2026-25961

creationtimestamp| type| source ---|---|--- 2026-02-09 22:18:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mehi4sz25j23...

CVE-2026-25761

creationtimestamp| type| source ---|---|--- 2026-02-09 21:20:08+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mehetze3mn22 2026-02-09 21:20:09+00:00| seen| https://bsky.app/profile/potato.software/post/3meheu2azx225...

CVE-2025-14831

creationtimestamp| type| source ---|---|--- 2026-02-09 20:38:05+00:00| seen| https://seclists.org/oss-sec/2026/q1/155 2026-02-09 21:59:21+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mehh26gnqo23 2026-02-10 14:25:28+00:00| seen|...

CVE-2026-25791 Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored...

CVE-2025-12699

creationtimestamp| type| source ---|---|--- 2026-02-09 20:31:35+00:00| seen| https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-041-01...

CVE-2026-1486

creationtimestamp| type| source ---|---|--- 2026-02-09 20:24:03+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mehbpr3lqv23 2026-02-09 20:24:44+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mehbqyfm4i2v 2026-02-10 20:10:05+00:00| seen|...

CVE-2026-25057

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration courses//assignments/uploadconfigfiles. The uploaded zip file entry names are used to create paths to...

CVE-2026-25495

creationtimestamp| type| source ---|---|--- 2026-02-09 18:02:59+00:00| published-proof-of-concept| https://github.com/craftcms/cms/security/advisories/GHSA-2453-mppf-46cj 2026-02-09 23:40:05+00:00| seen| https://gist.github.com/alon710/05c03b478ac40a36955b23403707c5ec...

CVE-2026-23906

creationtimestamp| type| source ---|---|--- 2026-02-09 16:27:41+00:00| seen| https://seclists.org/oss-sec/2026/q1/154 2026-02-09 20:19:16+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mehbh7zacn26 2026-02-10 16:25:17+00:00| seen|...

CVE-2026-24343

creationtimestamp| type| source ---|---|--- 2026-02-09 15:24:09+00:00| seen| https://seclists.org/oss-sec/2026/q1/153 2026-02-09 16:45:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3megvi4cpd52b 2026-02-10 16:25:24+00:00| seen|...

CVE-2025-63354

Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fails to properly handle inputs, allowing an attacker to inject and execute JavaScript...

CVE-2026-0870

creationtimestamp| type| source ---|---|--- 2026-02-09 06:14:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10702-b40aa-2.html 2026-02-09 07:17:55+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mefvrzdoi62v...

CVE-2026-1615

creationtimestamp| type| source ---|---|--- 2026-02-09 05:18:05+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mefp3rgidt2m 2026-02-09 06:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116039144621552776 2026-02-09 06:00:34+00:00| seen|...

CVE-2026-25568

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time. When allowPrivateOnly is enabled, users can still create public boards due to incomplete server-side enforcement...